Data Processing Addendum

This addendum forms part of the Terms of Service between Bisux Limited ("we", "us", "our") and the business identified in the accepted account or order ("you"). You are the controller and we are the processor for the personal data covered here. Our separate controller activities are described in our Privacy Policy.

1. What we process and why

We process the data in Appendix A to provide the features you use, for the service period and the return or deletion period in section 8.

Your accepted agreement, this addendum, feature settings and lawful written support instructions are your documented instructions. This includes instructions about transfers. We process data only on those instructions, unless EU or Member State law requires otherwise. We tell you about that requirement before processing unless the law prohibits it.

You must have authority and a lawful basis for your instructions, give the required notices and collect only appropriate data. We tell you immediately if we consider an instruction contrary to EU or Member State data-protection law. We may pause the affected processing while we resolve it and will not follow an instruction we know is unlawful.

We do not use data processed for you for our own advertising or to train general-purpose models. Any separate controller activity needs its own purpose, lawful basis and notice.

2. People and confidentiality

We limit access to authorised people who need it to provide the service. They must be subject to contractual or statutory confidentiality duties. We give them appropriate security and data-protection instructions and remove access when it is no longer needed.

3. Security

We maintain technical and organisational measures appropriate to the risk under GDPR Article 32, including the commitments in Appendix B. We take account of the data, processing, available technology and implementation costs. We review material risks and changes and do not reduce protection below the legally required standard.

4. Subprocessors

You give general written authorisation for the identified subprocessors and activities in our Service Providers list. This authorisation covers only providers handling your data for us, not providers acting for their own purposes.

At least 30 days before a new or replacement subprocessor begins processing your data, we update that list and email your account address with its identity, activity and processing locations. You can object on reasonable data-protection grounds before it starts, by replying or emailing privacy@bisux.net. You do not need to accept the Terms again.

We work with you on a lawful alternative. If we cannot resolve an objection before processing starts, we do not send your data to that provider. We stop the affected processing if necessary, and you may end the affected service with a proportional refund for its unused prepaid period under Terms section 9. If a provider must be replaced urgently to protect the security or continuity of the service, we may give shorter notice, but we still explain why the change was urgent and give you sufficient time to assess it and object before the new provider begins processing your data; your objection rights above still apply.

We bind each subprocessor to the same relevant data-protection duties by contract. We remain fully liable to you for its performance of those duties and provide necessary information about it on request.

5. Transfers and disclosure requests

We transfer data or allow access outside the EEA only on documented instructions and under a lawful GDPR Chapter V mechanism. This may be an applicable adequacy decision or EU standard contractual clauses, with the required destination assessment and additional safeguards. Applicable transfer clauses prevail over conflicting terms. This addendum does not itself replace them.

We check government disclosure requests for legal validity, challenge them where appropriate, disclose only what is legally required and notify you unless prohibited. We record the basis for disclosure. The infrastructure safeguards in the Terms also apply where relevant to non-personal data.

6. Helping you comply

Taking account of the processing and information available to us, we help you answer individuals' rights requests. We forward requests about your data without undue delay. We do not answer for you unless instructed or legally required.

We assist with security, breach assessment and notifications, data-protection impact assessments and prior consultation under GDPR Articles 32–36. You remain responsible for your controller decisions.

Routine evidence and rights, security and assessment cooperation are included. Only genuinely exceptional additional work may carry a reasonable fee agreed in writing beforehand. Fees must never delay or prevent mandatory cooperation. We do not charge for correcting our own noncompliance, ordinary individuals' rights requests or switching covered by the Terms.

7. Personal-data breaches

We notify you without undue delay after becoming aware of a breach affecting data we process for you. We do not wait for a complete investigation.

As information becomes available, we provide the nature of the breach, affected categories and approximate numbers of people and records, a contact, likely consequences, and measures taken or proposed to contain and reduce harm. We give updates, preserve relevant evidence and cooperate with your assessment and notifications.

You decide your controller notifications unless the law requires us to act independently. A controller's potential 72-hour authority deadline is not permission for us to wait 72 hours before telling you.

8. Return and deletion

At the end of processing, you choose whether we return or delete your personal data. We then delete remaining copies unless EU or Member State law requires their retention. Send instructions to privacy@bisux.net.

Return covers the data, attachments and necessary record relationships, including material missing from the dashboard download. The free export, switching, transition and retrieval rights in Terms section 13 and its annex apply. We preserve the data needed for those rights and agree the practical return or deletion steps with you without undue delay. Following the applicable retrieval period, we complete erasure and confirm it, subject to required legal retention.

Routine removal defaults are 14 days after website deletion, 30 days after account deletion and 90 days after a website goes offline, with the actual removal date emailed to you. These are service-cleanup defaults, not a right to retain processor data against a lawful deletion instruction. They do not shorten switching, retrieval or rights-request periods.

Deletion instructions cover databases, files, caches and relevant provider copies. Any legal-retention copies are isolated and used only for that obligation. Residual backups must remain protected and excluded from ordinary use, expire under the applicable fixed backup cycle, and have deletion instructions reapplied if restored. We include separately operated stores in completion checks; deletion of an account entry alone does not establish that all copies have been erased.

9. Evidence and audits

We provide the information needed to demonstrate compliance with Article 28 and allow and contribute to audits, including inspections, by you or your appointed auditor.

Where sufficient, we begin with documents and remote checks. Routine inspections use reasonable advance notice, coordinated business hours, confidentiality and safeguards for other customers. These arrangements cannot block necessary inspections, regulator access or urgent investigations. There is no annual audit cap or compulsory certificate in place of audit rights.

Routine evidence is included. You pay your own auditor. Exceptional additional work by us follows the prior written reasonable-fee rule in section 6; curing our own noncompliance is included.

10. Responsibility and priority

Each party keeps its own legal duties. Commercial limits do not remove individuals' rights, supervisory powers or liability that cannot lawfully be excluded. This addendum prevails for processor-data protection as Terms section 2 explains. Mandatory law and applicable transfer clauses prevail over it.

11. Contact and agreement

Your details and authorised acceptance come from your business account or order. You accept this addendum through the Terms that incorporate it. For processing instructions, privacy matters or urgent data incidents, contact privacy@bisux.net.

Appendix A. Processing details

Subject: your hosted restaurant website and enabled features.
Operations: collection, recording, organisation, storage, retrieval, correction, authorised access, public display of content you publish, transmission, export and deletion.
Purposes: hosting your content; customer-directed menu import and translation; managing reservations and related messages; maintaining restaurant-specific guest history and reliability indicators; and technical assistance with those operations.
People: guests and bookers; your authorised staff whose details you supply; people identified in your uploaded content and messages.
Data: names, email addresses, phone numbers, restaurant content, files and images; booking date, time, party size, area, status, notes and internal notes; communications; marketing-choice flags; restaurant-specific booking, cancellation and no-show history and reliability indicators; technical identifiers needed for these features.
Health data: booking forms tell guests not to enter allergies or other health details and to contact the restaurant directly. This addendum does not authorise general health-record processing. Promptly remove accidental health notes unless you establish a separate lawful Article 9 condition and appropriate safeguards.
Duration: the feature's service period and section 8. You set proportionate booking and guest-history retention instructions, including for guest indexes, booking-outcome records and reliability indicators. A scoring window is not a data-retention period.
Outside this scope: our account relationship, sales, billing, tax, human account support, advertising, platform security and own visit statistics. The Privacy Policy explains those controller activities.

Appendix B. Security commitments

Access and separation: role and restaurant-ownership checks, least privilege, protected credentials, confidentiality and withdrawal of access when no longer needed.
Transmission: suitable protection for personal data in transit, including HTTPS for browser connections and risk-appropriate protection for internal file transfers.
Storage and secrets: restricted database and file access, protected keys and secrets, encrypted connected-service tokens and additional encryption appropriate to the risk.
Resilience: risk-appropriate backup, recovery and restoration arrangements, with checks of their effectiveness. No fixed recovery time or availability guarantee is included.
Application security: form forgery protection, anti-abuse checks and rate limits where appropriate, controlled changes and vulnerability handling.
Records: access-restricted, minimised logs. Sign-in/security database records are purged after 365 days and error database records after 90 days; infrastructure logs require their own schedules.
People and incidents: confidentiality, staff instructions, incident handling and the notification duties above.
Deletion: instructions and approved schedules applied across databases, files, providers, caches and backups, with completion checks.

Last updated: 10 November 2026

Bisux Limited is an Irish private company limited by shares, registered in Ireland (Companies Registration Office), company number 816985. Registered office: 51 Bracken Road, Dublin, D18 CV48, Ireland. General contact: hello@bisux.net.